cert-manager

acmesolver

ACME-solver image used by cert-manager to spin up HTTP-01 challenge-response pods. Image attrset with repository and tag.

Type: anything

Default:

{
  image = {
    repository = "quay.io/jetstack/cert-manager-acmesolver";
    tag = "v1.17.1";
  };
}

cainjector

CA-injector component config. Sets the image attrset and replicaCount for the controller that injects CA bundles into webhooks, APIServices, and CRDs. The replica count defaults from the cluster’s availability level (v2_discussions/145).

Type: anything

Default:

{
  image = {
    repository = "quay.io/jetstack/cert-manager-cainjector";
    tag = "v1.17.1";
  };
  replicaCount = 1;
}

dns01RecursiveNameservers

Comma-separated list of recursive nameservers used to verify DNS-01 ACME challenges (e.g. 8.8.8.8:53,1.1.1.1:53). Empty string falls back to the system resolver.

Type: string

Default:

""

dns01RecursiveNameserversOnly

If true, only the nameservers in dns01RecursiveNameservers are used for DNS-01 self-checks (skipping cluster DNS entirely).

Type: boolean

Default:

false

image

Image for the cert-manager controller Deployment. Attrset with repository, tag, and pullPolicy keys.

Type: anything

Default:

{
  pullPolicy = "IfNotPresent";
  repository = "quay.io/jetstack/cert-manager-controller";
  tag = "v1.17.1";
}

installCRDs

Whether kix should emit the cert-manager CRDs (Certificate, Issuer, Challenge, etc.). Set to false when CRDs are managed out-of-band.

Type: boolean

Default:

true

prometheus

Prometheus scrape config for cert-manager. When enabled is true, kix wires up the metrics endpoint annotations on the controller Service.

Type: anything

Default:

{
  enabled = false;
}

replicaCount

Number of replicas for the cert-manager controller Deployment. Defaults from the cluster’s availability level (v2_discussions/145).

Type: signed integer

Default:

1

resources

Optional resource requests/limits attrset applied to the controller container. null leaves the container’s resource block unset.

Type: null or anything

Default:

null

webhook

Webhook component config. Sets the image attrset and replicaCount for the admission webhook that validates and mutates cert-manager CRs. The replica count defaults from the cluster’s availability level (v2_discussions/145).

Type: anything

Default:

{
  image = {
    repository = "quay.io/jetstack/cert-manager-webhook";
    tag = "v1.17.1";
  };
  replicaCount = 1;
}